[Here’s an oped of mine that recently ran on Reuters.  Readers will recognize many of these themes and arguments since I have developed them here on the TLF many times before.]

Privacy Regulation and the “Free” Internet

by Adam Thierer, Mercatus Center at George Mason University

Would you like to pay $20 a month for Facebook, or a dime every time you did a search on Google or Bing?  That’s potentially what is at stake if the Obama administration and advocates of stepped-up regulation of online advertising get their way.

The Internet feels like the ultimate free lunch.  Once we pay for basic access, a cornucopia of seemingly free services and content is at our fingertips.  But those services don’t just fall to Earth like manna from heaven.  What powers the “free” Internet are data collection and advertising. In essence, the relationship between consumers and online content and service providers isn’t governed by any formal contract, but rather by an unwritten  quid pro quo: tolerate some ads or we’ll be forced to charge you for service.  Most consumers gladly take that deal—even if many of them gripe about annoying or intrusive ads, at times.

Nonetheless, calls for regulation persist, especially as advertising grows more sophisticated.  More targeted forms of online advertising hold the promise of better ads more closely tailored to consumers’ interests.  But that also raises anxieties among some Web surfers who fear their privacy might be undermined by increased data collection or “tracking.”

To address those concerns, the Federal Trade Commission (FTC) and the Department of Commerce have stepped-up activity in this arena and has suggested that new rules may be needed. Earlier this month, the FTC released a report endorsing a new regulatory framework, including a so-called “Do Not Track” mechanism to allow easier consumer opt-outs of online data collection and advertising.  Last Thursday, the Commerce Department followed suit with a new report calling for expanded oversight and a new Privacy Policy Office within Commerce.  Meanwhile, discussion continues in Congress about a new “baseline” privacy law.

The stakes in the debate are significant since regulation could fundamentally alter the nature of online commerce and the future of how digital content and services are provided.  Curtailing data collection and online advertising could be killing the goose that lays the Internet’s golden eggs.  Such regulation will likely have a particularly deleterious impact on small publishers and service providers, who depend almost entirely upon online advertising.  In turn, this could curtail new entry and innovation—and new forms of speech and culture.

Some regulatory advocates don’t hide their desire to move the U.S. in the direction the European Union has charted with its “data directives” and more stringent forms of privacy regulation.  But America’s refusal thus far to walk down that more regulatory path offers scholars the chance to evaluate Europe’s more restrictive approach and study whether America’s lead in the global digital marketplace might be tied to its more “hands-off” approach to online regulation. A recent study by Avi Goldfarb and Catherine Tucker found that “after the [European Union’s] Privacy Directive was passed [in 2002], advertising effectiveness decreased on average by around 65 percent in Europe relative to the rest of the world.” They argue that because regulation decreases ad effectiveness, “this may change the number and types of businesses sustained by the advertising-supporting Internet.” Regulation of advertising and data collection for privacy purposes, it seems, can affect the global competitiveness of online firms.

Regulatory efforts will be complicated by the fact that privacy is a highly subjective condition and definitions of consumer “harm” vary widely.  Many of us don’t much worry about data collection or advertising online; we merrily go along our way surfing free sites, services, and content.  But a handful of vocal pro-regulatory privacy advocates and organizations have successfully convinced many policymakers that the hyper-sensitive concerns of a small minority should trump all other considerations.

Ironically, many of those privacy advocates bash copyright law and claim it is an information control regime, yet privacy regulation would constitute a stronger information control regime by creating the equivalent of copyright for personal information (which would, in turn, conflict mightily with the First Amendment).  In essence, privacy regulations limit the right of people to talk about other people, or communicate facts about them.  This raises serious free speech concerns and has particularly troubling ramifications for press freedoms.  Restrictions on advertising could also have an effect on non-commercial speech, such as political ads or non-profit communication.

Some proposed privacy regulations, such as a “Do Not Track” mandate, would also require a re-architecting of the Internet and the potential regulation of every Web browser to ensure compliance.  If our experience with attempting to eradicate email spam through regulation proves anything, it’s that such schemes are unlikely to work given the Net’s borderless nature.

There is a better path to balancing privacy interests and economic growth than through an onerous privacy regulatory regime. Educating and empowering consumers with more, and better, privacy-enhancing tools can help alleviate much of the concern about data collection or advertising intrusiveness.  The most-downloaded add-on for both the Firefox and Chrome web browsers is AdBlock Plus, which blocks advertising on most sites. A host of other tools are available to block or limit various types of data collection, and every major browser has privacy control tools and anonymous surfing modes to help users limit data collection.

Again, because privacy is a subjective condition, not everyone takes advantage of these empowerment tools.  The crucial point, however, is that the tools exist and they need not be perfect to be preferable to government regulation, which, in this case, could decimate the “free” Internet as we know it.

Adam Thierer is a senior research fellow at the Mercatus Center at George Mason University where he works with the Technology Policy Program. Thierer covers technology, media, Internet, and free speech policy issues with a particular focus in online child safety and digital privacy policy issues. The views expressed are his own.

By Adam Thierer & Berin Szoka

The goal of our “Privacy Solution Series,” as we noted in the first installment, is to detail the many “technologies of evasion” (i.e., user-empowerment or user “self-help” tools) that allow web surfers to better protect their privacy online—and especially to defeat tracking for online behavioral advertising purposes.  These tools and methods form an important part of a layered approach that, in our view, provides an effective alternative to government-mandated regulation of online privacy.

In this second installment in this series, we will highlight Adblock Plus (ABP), a free downloadable extension for the Firefox web browser (as well as for the Flock browser, though we focus on the Firefox version here).

Purpose: The primary purpose of Adblock Plus is to block online ads from being downloaded and displayed on a user’s screen as they browse the Web.  In a broad sense, this functionality might be considered a “privacy” tool by those who consider it an intrusion upon, or violation of, their “privacy” to be “subjected” to seeing advertisements as they browse the web.  But if one thinks of privacy in terms of what others know about you, Adblocking is not so much about “privacy” as about user annoyance (measured in terms of distracting images cluttering webpages or simply in terms of long download times for webpages).  In this sense, ABP may not qualify as a “technology of evasion,” strictly speaking.  But, as explained below the fold, ABP does allow its users to “evade” some forms of online tracking by blocking the receipt of some, but not all, tracking cookies.

Cost: Like almost all other Firefox add-ons, both the ABP extensions and the filter subscriptions on which it relies (as described below) are free.

Popularity / Adoption: While there are a wide variety of ad-blocking tools available, Adblock Plus is far and away the leader.  ABP has proven enormously popular since its release in November 2005 as the successor to Adblock, which was first developed in 2002 and reached over 10,000,000 downloads before being abandoned by its developer and even today garners nearly 40,000 downloads a week.  This history of Adblock provides further details.

ABP was named one the 100 best products of 2007 by PC World magazine and is now the #1 most downloaded add-on for Firefox with over 500,000 weekly downloads, up significantly for just a few months.  In a blog post last month, ABP creator Wladimir Palant estimated that “no more than 5% of Firefox users have Adblock Plus installed,” but that percentage is bound to grow larger as more people discover Adblock.  As one indicator of ABP’s popularity, the number of Google searches for “Adblock” has nearly eclipsed the number of searches for “identity theft,” which seems like a far more serious concern than having to look at web ads.

Of course, not every Firefox user would chose to use Adblock even if they were aware of it.  For example, one of us (Berin) finds it indispensable and leaves it on all the time.  The other (Adam) almost never turns it on, preferring to see what sort of ads are being served on each page he visits.  For those users primarily concerned with having their browsing tracked, there are other tools more effective than ABP for that purpose, as future entries in this series will describe.

This raises a point we make in our upcoming paper on online advertising and privacy:  Internet users all have different preferences and sensitivities when it comes to ads and online privacy.   Some of us find ads annoying, intrusive, and potentially privacy-violating.  Others of us just don’t care or even find some informational benefit in seeing them—especially when they are tailored to our particular interests.  Fortunately, tools like Adblock Plus let us each decide for ourselves what sort of browsing experience and privacy protections to use—rather than relying on the heavy, clumsy hand of Big Government to impose sweeping regulations that make a one-size-fits-all determination for everyone.

How Adblock Plus Works: Adblock Plus on its own offers nothing more than the capability to filter certain elements (images, external scrips, frames, Flash, etc.) sent to the user’s computer when they attempt to download the contents of a webpage.  Unbeknownst to many users, the HTML code of most webpages includes instructions to download images and other content (such as ads) stored on that website or on third party sites.  ABP does not recognize ad images as such, so it cannot automatically distinguish ads from non-ad content.  Instead, ABP relies on a blacklist of terms that the keeper of the list has determined correspond to parts of a URL used to load ads.  The following screenshot illustrates how ABP works:

The user here (Berin) subscribed to EasyList USA, the most commonly-used U.S. “filter” (blacklist + whitelist) when he first installed AdBlock.  (Additional filter subscriptions are available here.)  The “filter rules” are ranked by “Hits” or number of ads blocked since the filter was installed (in May 2008).  Shown here are only the top examples of effective filters, such as any URL that begins with “http://ad.” or contains “/ads/”.  Also shown here are three custom ad filters created by Berin.  This clip (click on “Show me how this is done”) illustrates how users can block images to create their own custom ad filter.  Last, the green text is just the most commonly-applied filter rule contained in EasyList’s white list of terms that should not be blocked, trumping black list filters.  For example, htttp://wikimedia.org/wikipedia/ads/… would normally be blocked because of the “/ads/” filter rule in the blacklist, but the green white list filter rule in our example trumps that rule to make sure that all URLs containing “htttp://*.wikimedia.org/wikipedia” (where * is a wild card operator) will not be blocked.

As mentioned above, ABP can block the downloading of some tracking cookies by preventing the user’s computer from attempting to download an element (usually an image) associated with that cookie—called “web bugs” or “web beacons.”  As Wikipedia explains:

Originally, a Web bug was a small (usually 1×1 pixel) transparent GIF or PNG image (or an image of the same colour of the background) that was embedded in an HTML page, usually a page on the Web or the content of an e-mail. Modern Web bugs also use the HTML IFrame, style, script, input link, embed, object, and other tags to track usage. Whenever the user opens the page with a graphical browser or e-mail reader, the image or other information is downloaded. This download requires the browser to request the image from the server storing it, allowing the server to take notice of the download. As a result, the organization running the server is informed when the HTML page has been viewed.

Larger Implications: As you can imagine, advertising networks and advertisers are less than thrilled about the idea of users blocking their ads, but it is website operators that have thus far objected most strongly to ad-blocking, because it threatens what is for many websites the only source of revenue.  Even amateur sites that do not have to pay for content production often rely on advertising revenue to cover other costs, such as hosting.  It’s not hard to imagine why many site operators might want to discourage or thwart ad-blocking to maintain the quid pro quo of the online economy:  Users get free content and services from websites in exchange for looking at advertising, which websites can sell through ad networks to advertisers.  This dilemma is not unique to the online world, of course.  In the offline context, television advertisers have responded to ad-skipping via DVRs through increasing reliance on product placement.

But because web-browsing is an essentially interactive experience between the user’s browser and the website, website operators may have greater leverage in the relationship with a user who wants to block ads.  In particular, the website may be able to detect the use of ABP, at least indirectly through the pattern of page element blocking caused by ABP’s use. (Prior to June 2008, websites could directly detect whether a browser was using ABP by noticing the presence of an API interface designed to allow ABP to work with other extensions, but this feature was removed in a recent update to ABP.)

Thus, once adblocking rises above a certain “acceptable loss” threshold, a website could respond in at least three distinct ways:

1. Moral exhortation – websites might display this kind of pop-up notice to ABP users:

   

2. “Blocking” adblocking – Because ABP’s relies on relatively crude keyword filters to distinguish ad elements of a page from content elements, websites can confuse these filters by making advertisements less easily distinguishable from content.  On the one hand, websites might attempt to “embed” advertisements a la television product placement.  On the other, we may see ad networks rely more on distributing ads through websites directly, rather than from ad network servers, so that adblocking filters cannot easily identify ads by the source referenced in their URL.
3. Tying website functionality to the acceptance of tracking cookies – As mentioned above, Adblock will block some “tracking cookies” by blocking the downloading from ad network servers of web beacons—which is often how such cookies are placed on the uer’s computer in the first place.   By requiring the downloading of those cookies to access the full functionality of the site, websites might be able to require users to accept tracking cookies in exchange for full access to the site.

As is so often the case, this will likely result in a war of “spy v. spy,” whereby the user community develops better evasive measures, and the websites community develops better countermeasures, and so on–as illustrated in this scene from the 1998 Marky Mark cult-classic film, The Big Hit: (Warning: Includes foul language).

Related Reading & Links

• Download Adblock Plus for Firefox (ver. 0.7.5.5)
• Adblock for Flock browser
• Adblock Plus main page (English language version)
• Adblock Plus blog
• How to disable Adblock Plus on your bookmarked pages (i.e., create a whitelist for accepted ads)
• Wikipedia entry
• Interview with Adblock creator Wladimir Palant
• New York Times article: Noam Cohen, “Whiting Out the Ads, but at What Cost?” New York Times, September 3, 2007.
• Nick Carr on Adblock: “What Would Jesus Do?” (and Wladimir Palant’s response to such criticisms)
• YouTube demo videos:
http://www.youtube.com/v/RAYtLA1ZKW0&hl=en&fs=1 http://www.youtube.com/v/vl4_NEiyVIk&hl=en&fs=1